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Abstract 



We give some semantic results for an epistemic logic incorporating dynamic oper- 
ators to describe information changing events. Such events include epistemic changes, 
where agents become more informed about the non-changing state of the world, and ontic 
changes, wherein the world changes. The events are executed in information states that 
I 1 ■ are modeled as pointed Kripke models. Our contribution consists of three semantic re- 

^2 ' suits, (i) Given two information states, there is an event transforming one into the other. 

O ■ The linguistic correspondent to this is that every consistent formula can be made true in 

every information state by the execution of an event, (ii) A more technical result is that: 
■ every event corresponds to an event in which the postconditions formalizing ontic change 

I> ' are assignments to 'true' and 'false' only (instead of assignments to arbitrary formulas 

in the logical language). 'Corresponds' means that execution of either event in a given 
information state results in bisimilar information states, (iii) The third, also technical, 
result is that every event corresponds to a sequence of events wherein all postconditions 
are assignments of a single atom only (instead of simultaneous assignments of more than 
• one atom). 

O 

O ■ 1 Introduction 



In dynamic epistemic logics [T6j[9l[T9l[3l[29] one does not merely describe the static (knowledge 
and) beliefs of agents but also dynamic features: how does belief change as a result of events 
taking place. The main focus of such logics has been change of only belief, whereas the facts 
describing the world remain the same. Change of belief is known as epistemic change. One 
can also model change of facts, and the resulting consequences of such factual changes for the 
beliefs of the agents. Change of facts is also known as ontic change (change of the real world, 
so to speak) In this contribution we use 'event' to denote any sort of information change, 
both epistemic and ontic. Let us begin by a simple example involving various events. 

Example 1 Given are two players Anne and Bill. Anne shakes a cup containing a single 
coin and deposits the cup upside down on the table (there are no opportunities for cheating). 
Heads or tails? Initially, we have a situation wherein both Anne (a) and Bill (b) are uncertain 
about the truth of that proposition. A player may observe whether the coin is heads or tails, 
and/or flip the coin, and with or without the other player noticing that. Four example events 
are as follows. 
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1. Anne lifts the cup and looks at the coin. Bill observes this but is not able to see the 
coin. All the previous is common knowledge to Anne and Bill. 

2. Anne lifts the cup and looks at the coin without Bill noticing that. 

3. Anne lifts the cup, looks at the coin, and ensures that it is tails (by some sleight of 
hand). Bill observes Anne looking but is not able to see the coin, and he considers it 
possible that Anne has flipped the coin to tails (and this is common knowledge). 

4. Bill flips the coin (without seeing it). Anne considers that possible (and this is common 
knowledge) . 

Events 1, 3, and 4 are all public in the sense that the actual event is considered possible by 
both agents, and that both agents know that, and know that they know that, etc.; whereas 
event 2 is private: Bill is unaware of the event; the event is private to Anne. Events 3 and 4 
involve ontic change, whereas events 1 and 2 only involve epistemic change. Flipping a coin 
is ontic change: the value of the atomic proposition 'the coin is heads' changes from false to 
true, or from true to false, because of that. But in the case of events 1 and 2 that value, 
whether true or false, remains unchanged. What changes instead, is how informed the agents 
are about that value, or about how informed the other agent is. In 1 and 2, Anne still learns 
whether the coin is head or tails. In 1, Bill 'only' learns that Anne has learnt whether the 
coin is head or tails: he has not gained factual information at all. In Example [6j later, we 
will formalize these descriptions. H 

Various logics have been proposed to model such events. A well-known setting is that of 
interpreted systems by Halpern et al. [7]. Each agent has a local state; the local states of 
all agents together with a state of the environment form a global state; belief of an agent is 
modelled as uncertainty to distinguish between global states wherein the agent has the same 
local state, and change of belief is modelled as a transition from one global state to another 
one, i.e. as a next step in a run through the system. In an interpreted system the treatment of 
epistemic and ontic change is similar — either way it is just a next step in a run, and how the 
valuation between different points changes is not essential to define or describe the transition. 
There is a long tradition in such research [241 [7] . 

The shorter history of dynamic epistemic logic started by focussing on epistemic change 
[HI O HU O [29] . In that community, how to model ontic change was first mentioned by Baltag, 
Moss, and Solecki as a possible extension to their action model logic for epistemic change [4j. 
More detailed proposals for ontic change are far more recent [31j [28J HTJ [231 El 021 ITT] - 
The literature will be discussed in more detail in Section [H 

Section [2] contains logical preliminaries, including detailed examples. Section [3] contains 
the semantic results that we have achieved for the logic. This is our original contribution to 
the area. These results are that: (i) for all finite models and for all consistent formulas we can 
construct an event that 'realizes' the formula, i.e., the formula becomes true after execution 
of the event; that: (ii) every event (with assignments of form p := ip, for (p in the language) 
corresponds to an event with assignments to true and false only; and also that: (Hi) every 
event corresponds to a sequence of events with assignments for a single atom only. Section 0] 
discusses related work in detail. 
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2 A logic of ontic and epistemic change 



We separately introduce the logical language, the relevant structures, and the semantics of 
the language on those structures. The syntax and semantics appear to overlap: updates are 
structures that come with preconditions that are formulas. In fact it is properly covered by the 
double induction used in the language definition, as explained after Definition below. For 
a detailed treatment of the logic without ontic change, and many examples, we recommend 
[29]; for more examples of the logic involving ontic change, see \27 \ 1281 151] . 

2.1 Language 

We use the style of notation from propositional dynamic logic (PDL) for modal operators 
which is also used in |23j. 

Definition 2 (Language) Let a finite set of agents A and a countable set of propositional 
variables P be given. The language Jz? is given by the following BNF: 

ip ::= p | -up | (p A <p | [a]ip 
a ::= a | B* | (U,e) 

where p G P, a £ A, B C A (the dynamic operator [B*] is associated with 'common knowledge 
among the agents in S'), and where (U,e) is an update as (simultaneously) defined below. H 

We use the usual abbreviations, and conventions for deleting parentheses. In particular, 
[B]ip stands for AaesI ]^' an< ^ (* ne diamond form) {a)ip is equivalent to -i[a]->(/?. Non- 
deterministic updates are introduced by abbreviation: [(U, e)U(U', f)](p is by definition [U, e]ipA 

2.2 Structures 

Epistemic model The models which adequately present an information state in a multi- 
agent environment are Kripke models from epistemic logic. The set of states together with 
the accessibility relations represent the information the agents have. If one state s has access 
to another state t for an agent a, this means that, if the actual situation is s, then according 
to a's information it is possible that t is the actual situation. 

Definition 3 (Epistemic model) Let a finite set of agents A and a countable set of propo- 
sitional variables P be given. An epistemic model is a triple M = (S, R, V) such that 

• domain S is a non-empty set of possible states, 

• R : A — > p(S x S) assigns an accessibility relation to each agent a, 

• V : P — > p(S) assigns a set of states to each propositional variable; this is the valuation 
of that variable. 

A pair (S,R) is called an epistemic frame. A pair (M, s), with s G S, is called an epistemic 
state. H 

A well-known notion of sameness of epistemic models is 'bisimulation'. Several of our 
results produce models that are bisimilar: they correspond in the sense that even when not 
identical (isomorphic), they still cannot be distinguished in the language. 



3 



Definition 4 (Bisimulation) Let two models M = (S,R,V) and W = (S',R',V') be 
given. A non-empty relation C S x S' is a bisimulation iff for all s E S and s' 6 S' with 

(s,0 E 



atoms for all p E P: s£ ^(p) iff s' E ^'(p); 

forth for all a E j4 and all t £ S: if (s,i) E R{o), then there is a t' E 5' such that 
(s',t r ) E i?» and (t,f) E fH; 

back for all a E vl and all i' E S": if (s',t') E R'(a), then there is a t E S such that 



We write (M, s) (M',s'), iff there is a bisimulation between M and M' linking s and s', 
and we then call (M, s) and (M',s') bisimilar. A model such that all bisimilar states are 
identical is called a bisimulation contraction (also known as a strongly extensional model). 

Update modejl An epistemic model represents the information of the agents. Information 
change is modelled as changes of such a model. There are three variables. One can change 
the set of states, the accessibility relations and the valuation. It may be difficult to find the 
exact change of these variables that matches a certain description of an information changing 
event. It is often easier to think of such an event separately. One can model an information 
changing event in the same way as an information state, namely as some kind of Kripke model: 
there are various possible events, which the agents may not be able to distinguish. This is 
the domain of the model. Rather than a valuation, a precondition captures the conditions 
under which such events may occur, and postconditions also determine what epistemic models 
may evolve into. Such a Kripke model for events is called an update model, which were first 
studied by Baltag, Moss and Solecki, and extended with simultaneous substitutions by van 
Eijck [UEI]. Here we use van Eijck's definition. 

Definition 5 (Update model) An update model for a finite set of agents A and a language 
is a quadruple U = (E, R, pre, post) where 

• domain E is a finite non-empty set of events, 

• R : i -> p(E x E) assigns an accessibility relation to each agent, 

• pre : E — > Jz? assigns to each event a precondition, 

• post : E — > (P — ► Jz?) assigns to each event a postcondition for each atom. Each post(e) 
is required to be only finitely different from the identity id; the finite difference is called 
its domain dom(post(e)). 

A pair (U,e) with a distinguished actual event e E E is called an update. A pair (U, E) with 
E' C E and |E'| > 1 is a multi-pointed update, first introduced in [30]. The event e with 
pre(e) = T and post(e) = id we name skip. An update with a singleton domain, accessible to 
all agents, and precondition T, is a public assignment. An update with a singleton domain, 
accessible to all agents, and identity postcondition, is a public announcement. H 

2 In the literature update models are also called action models. Here we follow [23| and call them update 
models, since no agency seems to be involved. 
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Instead of 



pre(e) = tp and post(e)(pi) =ipi, and post(e)(p n ) = ip n 
we also writ^l 

for event e: if tp, then pi := ifii, and p n := ip n . 

The event skip stands for: nothing happens except a tick of the clock. 

To see an update as part of the language we observe that: an update (U, e) is an inductive 
construct of type a that is built the frame underlying U (we can assume a set enumerating such 
frames) and from simpler constructs of type tp, namely the preconditions and postconditions 
for the events of which the update consists. This means that there should be a finite number 
of preconditions and a finite number of postconditions only, otherwise the update would be an 
infinitary construct. A finite number of preconditions is guaranteed by restricting ourselves 
in the language to finite update models. A finite number of postconditions is guaranteed by 
(as well) restricting ourselves to finite domain for postconditions, this situation is similar to 
the case of automata-PDL [TOj chapter 10, section 3]. 

If in case of nondetermistic updates the underlying models are the same, we can also see 
this as executing a multi-pointed update. For example, (U,e) U (U,f) can be equated with 
(U,{e,f». 

Example 6 Consider again the scenario of Example [1] on page [TJ Let atomic proposition p 
stand for 'the coin lands heads'. The initial information state is represented by a two-state 
epistemic model with domain {1,0}, with universal access for a and b, and with V(p) = {1}. 
We further assume that the actual state is 1. This epistemic state is depicted in the top- left 
corner of Figure HJ The events in Example [1] can be visualized as the following updates. The 
actual state is underlined. 

1. Anne lifts the cup and looks at the coin. Bill observes this but is not able to see the 
coin. All the previous is common knowledge to Anne and Bill. 

a,b p b — »- np a, b 

Here, pre(p) = p, post(p) = id, pre(np) = -ip, post(np) = id. The update model consists 
of two events. The event p corresponds to Anne seeing heads, and the event np to Anne 
seeing tails; Anne is aware of that: thus the reflexive arrows (identity relation). Bill 
cannot distinguish them from one another: thus the universal relation. The aspect of 
common knowledge, or common awareness, is also present in this dynamic structure: 
the reflexive arrow for Anne also encodes that Anne knows that she lifts the cup and 
that Bill observes that; similarly for Bill, and for iterations of either awareness. 

2. Anne lifts the cup and looks at the coin without Bill noticing that. 

— b—*- skip a, b 




3 The notation is reminiscent of that for a knowledge-based program in the interpreted systems tradition. 
We discuss the correspondence in Section U 
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Event p is as in the previous item and skip is as above. In this update, there is no 
common awareness of what is going on: Anne observes heads knowing that Bill is 
unaware of that, whereas Bill does not consider the actual event; the 6-arrow points to 
the other event only. 

3. Anne lifts the cup, looks at the coin, and ensures that it is tails (by some sleight of 
hand). Bill observes Anne looking but is not able to see the coin, and he considers it 
possible that Anne has flipped the coin to tails (and this is common knowledge). 



a, b p < — b — * np a, b 

b b 
W / 

a, b p' 

Events p and np are as before, whereas pre(p') = T, post(p')(p) = _L. The event p' may 
take place both when the coin is heads and when the coin is tails, in the first case atom 
p is set to false (tails), and in the second it remains false. 

4. Bill flips the coin (without seeing it). Anne considers that possible (and this is common 
knowledge) . 

a, b n ■«— a — skip a, b 

Here, pre(n) = T, post(n)(p) = —ip, and skip is as before. For models where all accessi- 
bility relations are equivalence relations we will also use a simplified visualization that 
merely links states in the same equivalence class. E.g., this final event is also depicted 
as: 

n — a — skip 



2.3 Semantics 

The semantics of this language is standard for epistemic logic and based on the product 
construction for the execution of update models from the previous section. Below, R(B)* is 
the transitive and reflexive closure of the union of all accessibility relations R(a) for agents 
a £ B. Definitions [7] and [8] are supposed to be defined simultaneously. 

Definition 7 (Semantics) Let a model (M, s) with M = (S, R, V) be given. Let a G A, 

BOA, and <p, ip G Jzf . 



(M,s) 




iff 


s G V(p) 




(M,s) 


H -«p 


iff 






(M,s) 


(= ip A ip 


iff 


(M, s) \= ip and (M, s) \= ip 




(M,s) 


(= [*]<P 


iff 


(M, t) \= ip for all t such that 


(s,t) G R(a) 


(M,s) 




iff 


(M, t) \= <p for all t such that 


(s,t) G R(B)* 


(M,s) 


H[U,e]</> 


iff 


(M, s) \= pre(e) implies (M <g> 


\J,(s,e))\=<p 
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a, b 1 a, b > a, 6 



X 



a P b *■ skip a, b 



n 

(i,p) 
/ \ 

^ / \ ^ 

a, 6 (1, skip) 6 — *■ (0, skip) a, b 



Figure 1: In an epistemic state where Anne and Bill are uncertain about the truth of p (heads 
or tails), and wherein p is true, Anne looks at the coin without Bill noticing it. The actual 
states and events are underlined. 



We now define the effect of an update on an epistemic state — Figure Q] gives an example 
of such update execution. 

Definition 8 (Execution) Given are an epistemic model M = (S,R,V), a state s G S, an 
update model U = (E, R, pre, post), and an event e € E with (M,s) \= pre(e). The result of 
executing (U, e) in (M, s) is the model (M <g> U, (s, e)) = ((£", R' , V), (s, e)) where 

. S' = {(t,f) I (M,t) h pre(f)}, 

• R'(a) = {((t,f),(u,g)) | (t,f),(u,g) G S' and (t,u) G R(a) and (f,g) G R(a)}, 

. V'{p) = {(t,f) | (M,t) \= post(f)(p)}. H 



Definition 9 (Composition of update models) Let update models U = (E, R, pre, post) 
and U' = (E', R', pre', post') and events e G E and e' G E' be given. The composition 
(U,e) ; (U',e') of these update models is (U",e") where U" = (E", R", pre", post") is defined 

as 

• E" = E x E', 

. R"(a) = {((f,f'),(g,g')) | (f,g) G R(a) and (f',g') G R'(a)}, 
. pre"(f,f') = pre(f)A[U,f]pre'(f), 

• dom(post"(f,f')) = dom(post(f)) U dom(post'(f')) and if p G dom(post"(f, f')), then 

nnQt "f f ft\ ( „\ _ / P° st ( f )(p) if P £ dom(post'(f')), 

P { ' >{P> \ [U,f]post'(f')(p) otherwise. 

The reason for [U, f]post'(f')(p) in the final clause will become clear from the proof detail 
shown for Proposition 1101 

Proposition 10 |= [U,e][U',e>^ [(U,e) ; (U',e')]<p H 
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Proof Let (M,t) be arbitrary. To show that (M,t) \= [(U,e) ; (\J',e')]<p if and only if 
(M, t) \= [U, e] [U', eV, it suffices to show that M <E> (U ; U') is isomorphic to (M <g> U) ® U'). 
A detailed proof (for purely epistemic updates) is found in The postconditions (only) 
play a part in the proof that the valuations correspond: 

For the valuation of facts p in the domain of post" we distinguish the cases ( p € 
dom(post(e)) but p £ dom(post'(e')) ) (i), and otherwise (ii). The valuation of a i-atom 
in a triple (t, (e, e')) is post(e)(p) according to the definition of updates composition; and the 
valuation of a ii-atom is [U, e]post'(e')(p). Consider the corresponding triple ((i, e),e'). The 
valuation of an i-atom in (t,e) is post(e)(p), and because p does not occur in dom(post'(e')) 
its value in the triple ((£, e),e') will remain the same. For a u-atom, its final value will be 
determined by evaluating post'(e')(p) in ((M ® U),(i, e)). This corresponds to evaluating 
[U,e]post'(e')(p) in (M,t). 

2.4 Proof system 

A proof system UM for the logic is given in Table [U The proof system is a lot like the proof 
system for the logic of epistemic actions (i.e., for the logic without postconditions to model 
valuation change) in [4]. There are two differences. The axiom 'atomic permanence' in [3]— 
[U,e]p «-> (pre(e) — > p) — is now instead an axiom expressing when atoms are not permanent, 
namely how the value of an atom can change, according to the postcondition for that atom: 

[U,e]p <-> (pre(e) — ► post(e)(p)) update and atoms 

The second difference is not apparent from Table [TJ The axiom 

[U,e][U',e'](/? <-> [(U,e) ; (\J',e')]ip update composition 

also occurs in [3]. But Definition [9] to compute that composition is in our case a more complex 
construction than the composition of update models with only preconditions, because it also 
involves resetting the postconditions. We find it remarkable that these are the only differences: 
the interaction between postconditions for an atom and the logical operators, only occurs in 
the axiom where that atom is mentioned, or implicitly, whereas the interaction between 
preconditions and the logical operators appears in several axioms and rules. 

The proof system is sound and complete. The soundness of the 'update and atoms' axiom 
is evident. The soundness of the 'update composition' axiom was established in Proposition 
[TOl We proved completeness of the logic as a modification of the completeness proof for the 
logic without ontic change — action model logic — as found in [29J, which in turn is a simplified 
version of the original proof for that logic as found in [2]. We do not consider the modified 
proof of sufficient original interest to report on in detail. 

3 Semantic results 

We now present some semantic peculiarities of the logic. These we deem our contribution 
to the area. The results help to relate different approaches combining ontic and epistemic 
change (see Section The various 'normal forms' for update models that we define are 
also intended to facilitate future tool development. Finally, they are relevant when modelling 
AGM belief revision [1] in a dynamic epistemic setting. 
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distribution 
modus ponens 
necessitation 
update and atoms 
update and negation 
update and conjunction 
update and knowledge 
update composition 



mix 



induction axiom 



Let (U,e) be an update model and let a 
set of formulas Xf f° r every f such that 
(e, f) G R(B)* be given. From Xf — ► [U,f]<£> 
and (xf A pre(f)) — > [a]xg for every f G 
E such that (e,f) G R(-B)*, a e B and 
(f,g)GR(a), infer Xe -> [U,e][BV 



updates and common 
knowledge 



Table 1: The proof system UM. 



3.1 Arbitrary belief change 

Let (M, s) and (M 1 , s') be arbitrary finite epistemic states for the same set of atoms and 
agents, with M = (S,R,V) and M' = (S',R',V'). Surprisingly enough, there is almost 
always an update transforming the former into the latter. There are two restrictions. Both 
restrictions are technical and not conceptual. Firstly, for the set of agents with non-empty 
access in M' there must be a submodel of M containing actual state s that is serial for 
those agents. In other words, if an agent initially has empty access and therefore believes 
everything ('is crazy') you cannot change his beliefs, but otherwise you can. This seems 
reasonable. Secondly, models M and M' should only differ in the value of a finite number of 
atoms; more precisely, if we define that 

an atom is relevant in a model iff its valuation is neither empty nor the entire 
domain, 

then the requirement is that only a finite number of atoms is relevant in M U M'. This is 
required, because we can only change the value of a finite number of atoms in the postcondi- 
tions. This also seems reasonable: as both models are finite, the agents can only be uncertain 
about the value of a finite number of atoms (in the combined models M and M'); in other 
words, they are 'not interested' in the value of the remaining atoms. 

For expository purposes we initially assume that all agents consider the actual state s of 
M a possibility (as in all S5 models, such as Kripke models representing interpreted systems), 
thus satisfying the first of the two restrictions above: the serial submodel required is then the 
singleton model consisting of s, accessible to all agents. The update transforming (M, s) into 
(M' , s') can be seen as the composition of two intuitively more appealing updates. That will 
make clear how we can also describe the required update in one stroke. 
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In the first step we get rid of the structure of M. As the epistemic state (M, s) is finite, it 
has a characteristic formula <5(jvf )S ) [6j[21]Q We let the agents publicly learn that characteristic 
formula. This event is represented by the singleton update (U,e) defined as 

(({e}, R, pre, post),e) with pre(e) = 5cm, 8 )i f° r an a '■ ( e > e ) e R( a )> an d post(e) = id 

In other words, the structure of the current epistemic state is being publicly announced. The 
resulting epistemic state is, of course, also singleton, or bisimilar to a singleton epistemic 
state, as <5(m,s) holds in all states in M bisimilar to s. Without loss of generality assume that 
it is singleton. Its domain is {(s, e)}. This pair (s, e) is accessible to itself because for all 
agents, (s,s) G R(a) (all agents consider the actual state s a possibility), and (e,e) G R(a). 
The valuation of propositional variables in this intermediate state are those of state s in M. 
What the value is does not matter: we will not use that valuation. 

Now proceed to the second step. In the epistemic state wherein the agents have common 
knowledge of the facts in s, the agents learn the structure of the resulting epistemic state 
M' = (S 1 , R' , V) and their part in it by executing update (U', s') defined as 

((£', R', pre', post'), s') with for t! G S' : pre'(t') = T and for relevant p : post' (t')(p) = T iff t' G V'[p) 

Note that the domain 5" and the accessibility relation R' of U' are precisely those of M', the 
resulting final epistemic model. The postcondition post' is well-defined, as only a finite number 
of atoms (the relevant atoms) is considered. Because we execute this update in a singleton 
model with public access, and because it is executable for every event t', the resulting epistemic 
state has the same structure as the update: it returns S' and R' again. The postcondition 
delivers the required valuation of atoms in the final model: for each event t! in U' and for all 
revelant atoms p, p become true in t' if p is true in state t' in M' (post(t')(p) = T), else p 
becomes false. The value of irrelevant atoms remains the same. 

We combine these two updates into one by requiring the precondition of the first and the 
postcondition of the second. Consider U^, that is exactly as U' except that in all events t' 
in its domain the precondition is not T but <5(m,s) : the characteristic formula of the point 
s of (M,s). Update (U' r ,s') does the job: epistemic state (M ® \J' r ,(s,s')) is isomorphic to 
(M', s'). This will be Corollary 1131 of our more general result, to follow. 

Now consider the more general case that the agents with non-empty access in M' are serial 
in a submodel M ser of M that contains s, with domain S ser . In other words: at least all agents 
who finally have consistent beliefs in some states, initially have consistent beliefs in all states. 
The construction above will no longer work: if the actual state is not considered possible by 
an agent, then that agent has empty access in actual state (s, s') of (M (g> \J' r ), but not in s' 
in M'. But if we relax the precondition Srj^ >s \, for the point s of (M,s), to the disjunction 
Vuggser 5(m,u)i that will now carry along the serial subdomain S ser , the construction will work 
because an agent can then always imagine some state wherein the update has been executed, 
even it that is not the actual state. This indeed completes the construction. 

Definition 11 (Update for arbitrary change) Given finite epistemic models M = (S,R,V) 
and M' = (S',R',V) for the same sets of agents and atoms. Assume that all agents with 

4 A characteristic formula ip for a state (M, s) satisfies that for all if), (M, s) \= ip iff tp \= ijj. In fact, for the 
construction we only need formulas that can distinguish all states in the domain from one another, modulo 
bisimilarity. Characteristic formulas satisfy that requirement. 



10 



non-empty access in M' are serial in M ser containing s. The update for arbitrary change 
(U", (s, s')) = ((E", R", pre", post"), (s, s')) is defined as (for arbitrary agents a and arbitrary 
relevant atoms p): 

E" = S' 

(t>')eR"(a) iff (t',u') e R'(a) 
pre"(i') = V« e s* fyfcf.u) 

"ffV ) f t iff e y'(p) 

P os t J(.PJ i otherwise 

The epistemic state (M® U", (s, s')) is bisimilar to the stipulated (M', s'), which is the desired 
result. It will typically not be isomorphic: M ® U" can be seen as consisting of a number 
of copies of M' (namely \S ser \ copies) 'with the accessibility relations just right to establish 
the bisimulation'. One copy may not be enough, namely when the state t in M to which 
that copy corresponds, lacks access for some agents. This access will then also be 'missing' 
between the states of ({t} x S'). But because of seriality one of the other M' copies will now 
make up for this lack: there is a u £ S ser such that (t,u) £ R(a), which will establish access 
when required, as in the proof of the following proposition. 

Proposition 12 Given (M,s), (M',s'), and U" as in Definition [HI Then 91 : ((M ® 
U"), (a, s')) ±± (M', s') by way of, for all t £ S ser and t' £ S': JH(t, t') = t'. H 

Proof Let i2® be the accessibility relation and V® the valuation in (M ® U"). 

atoms: For an arbitrary relevant atom p: (t,t') £ V®{p) iff (M,t) \= post" (t')(p), and 
by definition of post" we also have that (M,t) \= post" (t')(p) iff i' £ V'(p). Irrelevant atoms 
do not change value. 

forth: Let ({h,^), (t 2 ,t' 2 )) € R®(a) and ((ti,t / 1 ),t / 1 ) £ From ((*i,ti), (*2,ta)) € 
J?® (a) follows (ti,t' 2 ) £ #(a). By definition of 9\ we also have ((t 2 ,t' 2 ),t' 2 ) £ JH. 

back: Let ((ti,^),^) £ 91 and (ti,^) G A s M ser is serial for a, and t x £ S se \ there 

must be a t% such that (^1,^2) £ R{a). As (M,t 2 ) (= Vtedom(M ser ) ^(M,t) (because ^ is one of 
those t) we have that (t 2 ,t' 2 ) £ dom(M(g) U"). From that, (h,t 2 ) £ i?(a), and (t[,t 2 ) £ i?'(a), 
follows that ((h,t[), (t 2 ,t' 2 )) £ jR®(o). By definition of 9\ we also have ((t 2 ,t' 2 ),t' 2 ) £ 

Note that we keep the states outside the serial submodel M ser out of the bisimulation. Without 
the seriality constraint the 'back' condition of the bisimilarity cannot be shown: given a 
((il,^),^) £ 9\ and (t^t^) £ R'(a), but where t\ has no outgoing arrow for a, the required 
a-accessible pair from (ti,t[) does not exist. A special case of Proposition [12] is the Corollary 
already referred to during the initial two-step construction, that achieves even isomorphy: 

Corollary 13 Given (M, s), (M',s'), and U£. as above. Assume that M is a bisimulation 
contraction. Then (M ® U' r ) = M'. H 

Proof In this special case we have that (t, t') £ dom(M® U' r ) iff (M, t) \= pre'(i') iff (M, t) |= 
<^(M,s) f° r the point s of (M, s). As the last is only the case when t = s (as M is a bisimulation 
contraction), we end up with a domain consisting of all pairs (s,t') for all if £ S' , a 1-1- 
correspondence. The bisimulation 9^ above becomes the isomorphism 3(s, t') = t'. 

A different wording of Proposition [12] is that for arbitrary finite epistemic states (M, s) and 
(M',s') also satisfying the serial submodel constraint, there is an update (U,e) transforming 
the first into the second. A final appealing way to formulate this result is: 
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Corollary 14 Given are a finite epistemic state (M, s) and a satisfiable formula (p. If all 
agents occurring in p have non-trivial beliefs in state s of M, then there is an update realizing 
p, i.e., there is a (U,e) such that (M, s) \= (U,e}</?. H 

Using completeness of the logic, this further implies that all consistent formulas can be 
realized in any given finite model. We find this result both weak and strong: it is strong 
because any conceivable (i.e., using the same propositional letters and set of agents) formal 
specification can be made true whatever the initial information state. At the same time, it 
is weak: the current information state does apparently not give any constraints on future 
developments of the system, or, in the opposite direction, any clue on the sequence of events 
resulting in it; the ability to change the value of atomic propositions arbitrarily gives too 
much freedom. Of course, if one restricts the events to specific protocols (such as legal game 
moves [27], and for a more general treatment see [22]), the amount of change is constrained. 

AGM belief revision and belief update Our results on arbitrary belief change seem 
related to the postulate of success in AGM belief revision pQ . AGM belief revision corresponds 
to epistemic change, and AGM (in their terminology) belief update [13] corresponds to ontic 
change (unfortunately, in the AGM community 'update' means something far more specific 
than what we mean by that term). Given this correspondence we can achieve only expansion 
by epistemic change, and not proper revision; and the combination of ontic and epistemic 
change can be seen as a way to make belief update result in belief revision. Apart from this 
obvious interpretation of epistemic and ontic change, one can also view our result that all 
consistent formulas can be realized, differently: a consequence of this is that for arbitrary 
consistent ip and ip there is an update (U,e) such that [a]p — > (\J,e)[a]ip. In AGM terms: if 
(p is believed, then there is a way to revise that into belief of ip, regardless of whether <p A ip 
is consistent or not. In other words: revision with ip. is always successful. That suggests that 
our way of achieving that result by combining epistemic and ontic change might somehow 
simulate standard AGM belief revision. Unfortunately it immediately clear that we allow far 
to much freedom for the other AGM postulates to be fullfilled. It is clearly not a minimal 
change, for example. So walking further down this road seems infeasible. 

3.2 Postconditions true and false only 

The postconditions for propositional atoms can be entirely simulated by the postconditions 
true or false for propositional atoms. For a simple example, the public assignment p := ip 

can be simulated by a two-point update e A f (i.e., a nondeterministic event where all 

agents in A cannot distinguish e from f) such that pre(e) = ip, post(e)(j>) = T, pre(f) = -«p, 
post(f)(p) = _L. In the public assignment (p := p,q := ip) to two atoms p and q we would 
need a four-point update to simulate it, to distinguish all four ways to combine the values of 
two independent atoms. 

The general construction consists of doing likewise in every event e of an update model. 
For each e we make as many copies as the cardinality of the powerset of the range of the 
postcondition associated with that event. Below, the set {0, i } dom (p° st ( e )) represents that 
powerset. 

Definition 15 (Update model \J T± ) Given is update model U = (E, R, pre, post). Then 
ll" 0- = (E" 0- , R" 0- , pre" 11 , post" 0- ) is a normal update model with 
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• E T± = U eeE {(e, /) I / G {0, l}dom(post(e)) } 

. ((e,/),(e',/'))GR T± («) iff (e,e') € R(a) 

• pre T± (e,/) = pre(e) A A/(p)=i P°st(e)(p) A A/(p)=o -P ost ( e )(p) 
•Post-(e,/)(,)^{I «^>:J 

Proposition 16 Given an epistemic model M = (S, 22, V) and an update model U = 
(E, R, pre, post) with normal update model \J T± defined as above. Then (M(g>U) ±± (M®U TL ).-\ 

Proof We show that the relation £H : (M <g> U) ±± (M U TJ -) defined as 

((a, e), (a, e, /)) G 91 iff (M, a) |= pre T± (e, /) 

is a bisimulation. Below, the accessibility relations in (M<g> U) and (M<g) U 11 ) are also written 
as 22(a). 

atoms 

Let (a, e, /) be a state in the domain of (M ® U" 11 ). We have to show that for all atoms 
p, (M,s) |= post(e)(p) <-> post TL (e, f)(p). From the definition of post 11 it follows that 

post T± (e,/)(p) iff /(p) = l. 

From (M, s) |= pre 11 (e, /) and the definition of pre 11 follows that 

(M,a)|=post(e)(p) iff /(p) = 1 . 

Therefore 

(M,a) |= post(e)(p) ^ post T± (e, /)(p) . 

forth 

Assume that ((s, e), (s' , e')) G 22(a) and that ((s, e), (s, e, /)) G 9t. Let /' : dom(post(e')) - 
{0, 1} be the function such that 



f'(p) 



1 if (M,s') |= post(e')(p) 
otherwise 



Therefore (M, a') |= pre TL (e', /'). Therefore ((s', e'), (s', e', /')) G JR. From ((s, e), (a', e')) G 
22 TL (a) follows (a, a') G 22(a) and (e, e') G R(a). From (e, e') G R(a) and the definition of 
access 22 T± follows ((e, /), (e', /')) G 22 T± (a). From (a, a') G 22(a) and ((e, /), (e', /')) G 
22 TL (a) follows ((a,e,/),(a',e',/')) G 22(a). 

back 

Suppose ((a,e), (a,e, /)) G !EH and (a, e, /), (a', e', /') G 22(a). From the last follows 
(a, a') G 22(a) and ((e, /), (e', /')) G R TJ -(a), therefore also (e, e') G R(a). Therefore 
((a,e), (a,e')) G 22(a). That ((a',e'), (a',e',/')) G 9t, is established as in forth. 

Corollary 17 The logic of change with postconditions true and false only is equally expres- 
sive as the logic of change with arbitrary postconditions. H 
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Although it is therefore possible to use postconditions true and false only, this is highly 
unpractical in modelling actual situations: the descriptions of updates become cumbersome 
and lengthy, and lack intuitive appeal. 

A transformation result similar to that in Proposition [16] can not be established for the the 
logic with only singleton update models, i.e., the logic of public announcements and public 
assignments (as in [H]). If public assignments could only be to true and to false, then updates 
with assignments always result in models wherein the assigned atoms are true throughout the 

model, or false throughout the model. Therefore, there is no transformation of, e.g., p —>p 

into p -<p using public assignments and public announcements only. The construction 

above results in a two-event update model, that is not a singleton. 

A transformation result as in Proposition [16] immediately gives an expressivity result as 
in Corollary 1171 for the languages concerned. It is also tempting to see such a transformation 
result as a different kind of expressivity result. In two-sorted languages such as the one 
we consider in this paper one can then distinguish between the expressivity of two kinds of 
syntactic objects. A formula (up) corresponds to a class of models that satisfy that formula, 
and a modality (a) corresponds to a relation on the class of models. The ability to express 
more relations does not necessarily lead to the ability to express more classes of models, nor 
vice versa. For example, concerning formulas, epistemic logic without common knowledge is 
equally expressive as public announcement logic without common knowledge, and even equally 
expressive as public announcement and public assignment logic without common knowledge 
|14j . But, as we have now seen, more and more relations between the models can be expressed. 

3.3 Single assignments only 

Consider update model e a f for a single agent a and for two atoms p\ and p2 such 

that in e, if (p± then p\ := tp2 and p2 ■= <f3, and in f, if ip± then p\ := 995 and P2 := (f6- 
Can we also do the assignments one by one? In other words, does this update correspond to 
a sequence of updates consisting of events g in which at most one atom is assigned a value: 
the cardinality of dom(g) is at most 1. This is possible! First we 'store' the value (in a 
given model (M, s) wherein this update is executed) of all preconditions and postconditions 
in fresh atomic variables, by public assignments. This can be in arbitrary order, so we do 
it in the order of the <p{. This is the sequence of six public assignments q\ := (fi, 02 := p>2, 
</3 := 933, (74 := 994, := <f5, and qe := p>%. Note that such public assignments do not change 
the structure of the underlying model. Next we execute the original update but without 

postconditions. This is e' a f with pre(e') = pre(e) = ipi and pre(f') = pre(f) = (^4 

and with post(e') = post(f') = id. Note that q\ remains true whenever e' was executed, because 
qi was set to be true whenever p\ was true, the precondition of both e and e'. Similarly, q^ 
remains true whenever f was executed. We have now arrived at the final structure of the 
model, just not at the proper valuations of atoms. 

Finally, the postconditions are set to their required value, conditional to the execution of 
the event with which they are associated. Agent a must not be aware of those conditions 
(the agent cannot distinguish between e' and f ). Therefore we cannot model this as a public 
action. The way out of our predicament is a number of two-event update models, namely one 
for each postcondition of each event in the original update. One of these two events has as 
its precondition the fresh atom associated with an event in the original update, and the other 
event its negation, and agent a cannot distinguish between both. The four required updates 
are 
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• ei a e[ with in ei, if qi then p 2 := q2 and in e' l5 if ->qi then id 

• e 2 o, e' 2 with in e2, if qi then p% := q% and in e 2 , if then id 

• e3 a e 3 with in e3, if q^ then p§ := q$ and in e' 3 , if —1^4 then id 

• e4 a e 4 with in e4, if §4 then p$ := q§ and in e 4 , if — 1^4 then id 

Now, we are done. These four final updates do not change the structure of the model, when 
executed. Therefore, now having set the postconditions right, the composition of all these 
constructs is isomorphic to the original update model! The general construction is very much 
as in this simple example. 

Definition 18 (Update model U one ) Given an update model U = (E, R, pre, post), update 
model U one is the composition of the following update models: First perform £ eg E|dom(post(e))+ 
1| public assignments for fresh variables q, . . . , namely for each e € E, q$ := pre(e), and for all 
Pi, ■ ■ ■ ,p n £ dom(post(e)), q\ := post(e)(pi), q^ := post(e)(p n ). Then execute U but with 
identity ('trivial') postconditions, i.e., execute U' = (E, R, pre, post') with post'(e) = id for all 
e G E. Finally, execute £ e gE|dom(post(e))| two-event update models with universal access 
for all agents wherein for each event just one of its postconditions is set to its required value, 
by way of the auxiliary atoms. For example, for e € E as above the first executed update is 
ei A e 2 with in ei, if q$, then p\ := qf, and in e 2 , if ~>qQ then id. H 

Without proof the following proposition will be clear: 

Proposition 19 Given epistemic model M and update model U executable in M. Then U one 
is isomorphic to U, and (M ® U one ) is isomorphic to (M <8> U). H 

This result brings our logic closer to the proposals in [U [28] wherein only one atom is si- 
multaneously assigned a value. The relation to other proposals will be discussed in Section 
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4 Comparison to other approaches 

Action model logic Dynamic modal operators for ontic change, in addition to similar 
operators for epistemic change, have been suggested in various recent publications. As far as 
we know it was first mentioned by Baltag, Moss, and Solecki as a possible extension to their 
action model logic (for epistemic change), in [3]. This was by example only and without a 
language or a logic. A precise quotation of all these authors say on ontic change may be in 
order: 

Our second extension concerns the move from actions as we have been working 
them to actions which change the truth values of atomic sentences. If we make this 
move, then the axiom of Atomic Permanenc^ is no longer sound. However, it is 
easy to formulate the relevant axioms. For example, if we have an action a which 
effects the change p := p A -<q, then we would take an axiom [a]p <-> (PRE (a) — > 
p A -*q). Having made these changes, all the rest of the work we have done goes 
through. In this way, we get a completeness theorem for this logic. jU p. 24] 

5 I.e.: [a]p <-> (PRE(a) -> p) [1 p.15] 
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The logic that we present here is a realization of their proposal, and we can confidently 
confirm that the authors were correct in observing that "all the rest (...) goes through". To 
obtain such theoretical results the notion of simultaneous postconditions (assignments) for a 
finite subset of atomic propositional letters is essential; this feature is not present in [3] (but 
introduced in [31]). 

In a later proposal by Baltag [2] a fact changing action flipP is proposed that changes 
('flips') the truth value of an atom P, with accompanying axioms (for the proper correspondent 
action a resembling a single-pointed action model) [a]p <-> (pre(a) — > —>p) if u p changes value 
(flips) in a", and otherwise [a]p «-> (pre(a) — > p) p. 29]. The approach is restricted to ontic 
change where the truth value of atoms flips. In the concluding section of [2], the author defers 
the relation of this proposal to a general logic of ontic and epistemic change to the future. 

Recent work in dynamic epistemics More recently, in a MAS application-driven line of 
research [281 12Z] assignments are added to the relational action language of [25] but without 
providing an axiomatization. In this setting only change of knowledge is modelled and not 
change of belief, i.e., such actions describe transformation of S5 models only, such as Kripke 
models corresponding to interpreted systems. 

A line of research culminating in Logics of communication and change |23] also combines 
epistemic and ontic change. It provides a more expressive setting for logical dynamics than 
our approach. The logic presented here is a sublogic of LCC. In [23] the focus is on obtaining 
completeness via so-called reduction axioms for dynamic epistemic logics, by extending the 
basic modal system to PDL. Our treatment of postconditions, also called substitutions, stems 
from [31] . In the current paper we focus on specific semantic results, and, as said, we use a 
dynamic epistemic 'dialect', not full PDL. 

A recent contribution on combining public ontic and epistemic change, including detailed 
expressivity results for different combinations of static and dynamic modalities, is found in 
|14j . Our work uses a similar approach to ontic events but describes more complex than 
public events: the full generality of arbitrarily complex events involves exchange of cards 
among subgroups of the public, and other events with a 'private' (as opposed to public) 
character. 

Finally, a general dynamic modal logic is presented in [T7], where ontic changes are also 
studied. The semantics of this logic uses tree-like structures, and fixed points are introduced 
in the language to be able to reason about updates. 

Belief revision An independent recent line of investigation combining epistemic with ontic 
change arises from the belief revision community. Modelling belief revision, i.e., epistemic 
change, by dynamic operators is an old idea going back to Van Benthem [20]. In fact, this 
is one of the two original publications — together with [16] — that starts the area of dynamic 
epistemic logic. For an overview of such matters see [5|l26}l2"9]. But modelling ontic change — 
known as belief update |13] — in a similar, dynamic modal, way, including its interaction with 
epistemic change, is only a recent focus of ongoing research by Herzig and collaborators and 
other IRIT-based researchers |12[ [TTT [15] . Their work sees the execution of an event as so- 
called progression of information, and reasoning from a final information state to a sequence 
of events realizing it as regression — the last obviously relates to planning. The focus of 
progression and regression is the change of the theory describing the information state, i.e. 
the set of all true, or believed, formulas. As already mentioned in Section (3J the results for 
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arbitrary belief change in Proposition [12] and following corollaries can potentially be applied 
to model belief update in the AGM tradition. 

Interpreted systems In a way, dynamic epistemic logics that combine epistemic and ontic 
change reinvent results already obtained in the interpreted systems community by way of 
knowledge-based programs [25] [7]: in that setting, ontic and epistemic change are integrated. 
Let us point out some correspondences and differences, using the setting of van der Meyden's 
|24j . This work investigates the implementation of knowledge-based programs. The transition 
induced by an update between epistemic states, in our approach, corresponds exactly to a step 
in a run in an interpreted system that is the implementation of a knowledge-based program; 
the relation between both is explicit in van der Meyden's notion of the progression structure. 
Now the dynamic epistemic approach is both more general and more restrictive than the 
interpreted systems approach. It is more restrictive because dynamic epistemics assumes 
perfect recall and synchronicity. This assumption is implicit: it is merely a consequence of 
taking a state transition induced by an update as primitive. But the dynamic epistemic 
approach is also somewhat more general: it does not assume that accessibility relations for 
agents are equivalence relations, as in interpreted systems. In other words, it can also be 
used to model other epistemic notions than knowledge, such as introspective belief and even 
weaker notions. 

Knowledge-based programs consist of joint actions (a e , a±, a n ) where a e is an action 
of the environment and where a±,...,a n are simultaneous actions by the agents 1 to n. An 
agent a acts according to a conditions of the form l if ip' do a! , if <p" do a" , etc. Let 
us overlook the aspect that conditions ip' have the form of known formulas (by agent a). 
Still, such statements look familiar to our alternative format for what goes on in an event, 
as in '/or event e: if <p, then p\ := tpi, and p n := ip n . 7 (see after Definition [5] on 
page |4j. This correspondence is not really there, but the similar format is still revealing. 
The different cases in a knowledge-based program are like the different events in an update 
model, and they equally express non-determinism. This is a correspondence. There are 
also differences. In dynamic epistemics, the condition ip in 'if ip, then p\ := ipi, is 
both an executability precondition and an observation. Inasmuch as it is an observation, it 
determines agent knowledge. In the interpreted systems approach, observations are (with of 
course reason) modelled as different from preconditions. The assignments such as p\ := ip\ in 
the 'then' part of event descriptions are merely the ontic part of that event, with the 'if part 
describing the epistemic part. Epistemic and ontic features together correspond to actions 
such as a' in 'if (/?' do a h . In the interpreted systems approach, epistemic and ontic features 
of information change are therefore not separately modelled, as in our approach. 

5 Further research 

An unresolved issue is whether updates can be described as compositions of purely epistemic 
events (preconditions only) and purely ontic events (postconditions only). In [12] it is shown 
for public events, for a different logical (more PDL-like) setting. Such a result would be in 
the line of our other normalization results, and facilitate comparison to related approaches. 

The logic can be applied to describe cryptographic bit exchange protocols, including pro- 
tocols where keys change hands or are being sent between agents. The logic is very suitable 
for the description of protocols for computationally unlimited agents, such as described in 



17 



the cited O [18] . Using dynamic logics may be an advantage given the availability of model 
checking tools for such logics, as e.g. the very versatile epistemic model checker DEMO |30| 
by van Eijck. The current version of DEMO only allows epistemic events. But van Eijck 
and collaborators are in the process of extending DEMO with assignments (postconditions), 
needed to model events that are both epistemic and ontic. We eagerly await the completion 
of their efforts; our semantic results can then be demonstrated in that model checker. 

The results for 'arbitrary belief change' suggest yet another possibly promising direction. 
Under certain conditions arbitrary formulas are realizable. What formulas are still realizable 
if one restricts the events to those considered suitable for specific problem areas, such as forms 
of multi-agent planning? And given a desirable formula (a 'postcondition' in another sense of 
the word), what are the initial conditions such that a sequence of events realizes it? This is 
the relation to AI problems concerning regression as pointed out in the introductory section 
|12j . and also to reasoning given specific protocols, such as always has been the emphasis 
for knowledge-based programs in the interpreted systems community [7], and as recently 
investigated in [22] in a dynamic epistemic context. 
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